If you go there, know who can see it

Not applicable — what N/A means in each column, checked July 2026 and growing as wallets are added.

1. Open source. No user-held client to publish as source — these are custodial services running their own software. Binance.US, Bitcoin ATMs / kiosks, Bybit, Cash App (Bitcoin), Coinbase, Crypto.com, Gemini, Kraken, KuCoin, OKX, PayPal / Venmo, River, Robinhood Crypto, Spot Bitcoin ETF (IBIT, etc.), Strike, Swan.
2. Reproducible builds. Nothing to rebuild bit-for-bit from source: the custodial services ship no user-installed wallet, Hodl Hodl runs in the browser, and Phantom is closed-source. Binance.US, Bitcoin ATMs / kiosks, Bybit, Cash App (Bitcoin), Coinbase, Crypto.com, Gemini, Hodl Hodl, Kraken, KuCoin, OKX, PayPal / Venmo, Phantom, River, Robinhood Crypto, Spot Bitcoin ETF (IBIT, etc.), Strike, Swan.
3. Privacy features. The features tracked here — coin control, CoinJoin, Silent Payments, PayJoin, subaddresses — act on coins held in a wallet, so they don’t apply to anything that doesn’t manage your coins: custodial platforms hold them, no-KYC trading tools hand off to a wallet elsewhere, and air-gapped signers leave coin-level features to the software wallet you pair them with. Binance.US, Bisq, Bitcoin ATMs / kiosks, Bybit, Cash App (Bitcoin), Coinbase, Coldcard, Crypto.com, Cupcake, Gemini, Haveno, Hodl Hodl, Keystone, Kraken, KuCoin, OKX, PayPal / Venmo, River, Robinhood Crypto, RoboSats, Spot Bitcoin ETF (IBIT, etc.), Strike, Swan.
4. Telemetry. Read from an app’s store data-safety label; a web app (Hodl Hodl), a cash kiosk (Bitcoin ATMs), and a brokerage security (spot ETF) ship no companion app. Bitcoin ATMs / kiosks, Hodl Hodl, Spot Bitcoin ETF (IBIT, etc.).
5. Network control. The custodian runs the infrastructure and decides how it connects to the chain; you don’t run a node or choose a server. Binance.US, Bitcoin ATMs / kiosks, Bybit, Cash App (Bitcoin), Coinbase, Crypto.com, Gemini, Kraken, KuCoin, OKX, PayPal / Venmo, River, Robinhood Crypto, Spot Bitcoin ETF (IBIT, etc.), Strike, Swan.

1. IRS — digital-asset broker reporting (Form 1099-DA). Custodial brokers (exchanges) report customers’ sale proceeds to the IRS beginning with 2025 transactions; the separate rule that would have covered non-custodial “DeFi brokers” was repealed by Congress, so self-custody sales are not broker-reported. Self-custody is not tax invisibility — taxable events remain reportable by you. IRS Digital Asset guidance
2. FinCEN — Bank Secrecy Act. Banks and money-services businesses, a category that includes crypto exchanges, must verify customer identity (KYC), file a Currency Transaction Report for cash over $10,000, and file Suspicious Activity Reports. FinCEN — Bank Secrecy Act · IRS MSB Information Center
3. The Intercept — Coinbase Tracer sold to ICE (2022). A public-records contract (worth up to about $1.36M) shows Coinbase sold its blockchain-analytics product, including historical geo-tracking data, to U.S. Immigration and Customs Enforcement. Coinbase says Tracer analyzes only public blockchain data, not customer accounts. The Intercept: Coinbase Tracer / ICE
4. FedScoop — blockchain analytics for government. Firms such as Chainalysis and TRM Labs sell tracing tools to the IRS, FBI, DEA, and ICE (which moved to sole-source both in 2025) and count PayPal, Robinhood, and others as customers. Public blockchains such as Bitcoin and Ethereum are transparent by design, recording every transfer on a permanent, publicly readable ledger. FedScoop: blockchain analytics · Bitcoin white paper
5. Ledger — 2020 customer-data breach. A misconfigured interface exposed roughly one million customer emails and about 272,000 full names, postal addresses, and phone numbers, fueling years of phishing and physical extortion; a further breach through a payment processor followed in January 2026. Your identity can leak even when your keys do not. Ledger statement · Have I Been Pwned
6. The Block / ConsenSys — MetaMask and Infura (2022). ConsenSys’s privacy policy states that Infura, MetaMask’s default connection, collects your IP address and wallet address when you send a transaction; running your own node or another RPC avoids it. The Block: MetaMask / Infura
7. Open-source wallet code. Whether a wallet’s code is public and auditable is verifiable from its own repository. Electrum (MIT), Monero’s GUI, Wasabi, Sparrow, Feather, Trezor Suite, and BitBox publish complete source; others publish only part of it, so “Partial” and “Closed” reflect what can actually be inspected. Wikipedia: Electrum · electrum.org (MIT) · Monero source
8. Monero — how it works (project docs). Monero hides sender, receiver, and amount by default using ring signatures, stealth addresses, and RingCT, which is why analytics firms treat privacy coins as far harder to trace than transparent chains. Monero project docs
9. Reproducible / deterministic builds — project build documentation. Whether a wallet’s published binary can be rebuilt bit-for-bit from its source is documented by each project. Monero (deterministic CLI/GUI builds), Wasabi, Feather, Trezor, BitBox02, Coldcard and Blockstream Jade publish reproducible builds; Sparrow reproduces its archive packages but not yet its platform installers; Keystone is partial; Ledger’s secure-element firmware is closed under an STMicroelectronics NDA, so its most security-critical code cannot be independently rebuilt. Monero GUI (reproducible builds) · Wasabi Wallet · Coldcard
10. Privacy-coin availability on centralized exchanges (2026). Most large exchanges delisted Monero under AML pressure across 2024–2025. As of mid-2026, Kraken still lists XMR for clients outside the European Economic Area (including the US), and KuCoin remains one of the few offshore venues still supporting it; Coinbase never listed it. Privacy-coin listings change frequently — verify current status before relying on this. Kraken (EEA notice) · Monero project docs
11. App telemetry — App Store and Google Play “data collected” labels. The privacy label each app publishes states what usage and device data it collects. Open-source local wallets that connect peer-to-peer or to your own node — Monero GUI/CLI, Feather, Wasabi, Sparrow, Electrum — and air-gapped Coldcard (“no companion app phoning home”) report no data collection; Cake Wallet, along with its Monero.com and Cupcake apps, likewise reports none. Coldcard App Store labels
12. Bisq — release verification (deterministic JAR). The project publishes a SHA-256 hash of each release’s application JAR so anyone can rebuild it from the tagged source and confirm a match; the platform installers themselves are not yet deterministic, and a full reproducible-build system is described as only partially in place. Bisq Releases (JAR verification) · Bisq v1.10.0 notes
13. Electrum — reproducible distributables. The project states that its release distributables are reproducible and must be signed by two independent keys before publication; the Android build, however, is not currently reproducible from source, a gap tracked as an open issue in the project’s repository. electrum.org · Electrum issue #5839 (Android)
14. MetaMask — build determinism. The project’s own build-system issue notes that its extension build is not perfectly deterministic and can vary across platforms, and no reproducible-build process is published, so the distributed binary cannot be independently matched to its source. MetaMask issue #3999
15. Cake Wallet — Android build reproducibility. Independent rebuilds of the release APK produce files that differ from the published binary, documented in the project’s issue tracker for both Cake Wallet and Monero.com, and a standing community bounty to add reproducible-build support remained open as of 2026; reproducible builds for the Cupcake signer were announced as planned but are not yet confirmed. Cake Wallet issue #112 · Monero bounty: Cake reproducible build
16. Exodus — open-source scope. The company’s own documentation states that, while Exodus uses many open-source components, some components of the wallet are not open source; the closed portions of the client cannot be rebuilt from source, so the published binary is not reproducible. Exodus: Is Exodus open source?
17. Trust Wallet — closed-source app. The Android app was moved to closed-source development by its maintainer and is distributed under a proprietary license (only the separate Wallet Core library is open source), so the published binary cannot be rebuilt from source. WalletScrutiny: Trust Wallet · Wikipedia: Trust Wallet
18. RoboSats — release verification. The project distributes GPG-signed, SHA-256-checksummed release APKs (also carried by IzzyOnDroid) and publishes build-from-source instructions, but does not provide a reproducible, bit-for-bit build; as of the January 2026 listing no reproducible-build confirmation is recorded, so the published binary cannot be independently matched to its source. RoboSats Releases · IzzyOnDroid: RoboSats
19. Haveno — release verification. The project distributes GPG-signed release binaries with full build-from-source instructions and verifies peer identities against known key rings at runtime, but does not document a reproducible, bit-for-bit build, so the published binary cannot be independently matched to its source. Haveno Releases
20. Ready and Safe{Wallet} — app reproducibility. Both client apps are open source, but neither documents a reproducible, bit-for-bit build of its published app binary; the smart contracts underlying Safe are separately verifiable on-chain, which is a different check from rebuilding the client. Safe{Wallet} monorepo · Ready docs
21. Trezor Suite — usage analytics. Usage-data collection is opt-in and off by default, toggled with one click in Settings; when enabled it gathers anonymous interaction and error data (via AWS and Sentry) with no personal information or balances, and is not shared with third parties for advertising. Trezor Suite analytics docs · Google Play data safety
22. Blockstream Jade (Green app) — usage analytics. The “Help Us Improve” analytics feature is opt-in; when enabled it collects app-interaction data (language, region, button presses, load times, app and OS version) tied only to an opaque identifier, never to wallet, keys, balances, or transactions, is not shared with third parties, and can be disabled at any time. Blockstream Help Center · App Store privacy label
23. BitBox02 (BitBoxApp) — no analytics. Shift Crypto states that the BitBoxApp embeds no third-party tracking or advertising analytics (independently verified) and collects no personal identity data; the App Store label lists only identifiers that are not linked to identity. BitBox privacy (data sharing) · App Store privacy label
24. Keystone — no data collected. The companion app’s App Store privacy label states that the developer does not collect any data from the app; the device itself is air-gapped. Keystone App Store privacy label
25. Ledger Live — usage tracking. Debugging and usage-analytics SDKs are active by default (opt-out), collecting a per-device identifier, device properties, and detailed usage such as page views, clicks, and actions through a third-party analytics service; Ledger states that no name or email is collected, and users can limit this in settings. This default-on behavior has been widely reported. Ledger tracking policy · Protos: Ledger Live analytics
26. MetaMask — usage analytics (MetaMetrics). Analytics are opt-in when onboarding with a seed phrase and on by default when signing up with a Google, Apple, or Telegram account; collected usage events are pseudonymous (via Segment and Mixpanel), may be associated with wallet addresses and on-chain activity, exclude keys, and are not sold or used for advertising; they can be disabled in settings. Consensys Privacy Notice · MetaMask analytics settings
27. Exodus — usage analytics (third-party). Exodus requires no account or KYC and states that it collects little personal data, but its privacy policy discloses the use of third-party analytics services such as Google Analytics, along with third-party advertising cookies; the app’s optional anonymous usage analytics can be disabled in settings. The app is partly closed source, so this cannot be fully independently verified. Exodus Privacy Policy · Exodus: what data it can access
28. Trust Wallet — usage data (third-party analytics). Trust Wallet states a policy of zero personal tracking (no IP address or email) and requires no sign-up, but its privacy notice processes device and usage data under legitimate interest (not consent) and shares it with third-party analytics providers; there is no in-app control to switch this off, and the only stated remedy is a formal “right to object” request through a web form. The app is also closed source, so the collection cannot be independently verified. Trust Wallet Privacy Notice · App Store privacy label
29. Phantom — usage data (third-party analytics). Phantom requires no name, email, or phone number for the wallet and states that it does not associate IP addresses with a wallet or identity; its usage analytics are anonymous, routed to third-party analytics providers, and can be turned off in Settings → Security & Privacy. More extensive personal data applies only to opt-in fiat or KYC features handled by third-party partners. Phantom Privacy Policy · Phantom: turn analytics on or off
30. Ready and Safe{Wallet} — usage analytics. Both apps’ App Store labels list data collected but not linked to identity; Safe{Wallet} processes behavioral analytics with consent, deleted after 14 months, and Ready’s Google Play disclosure reports some data shared for advertising or marketing. Neither requires identity verification for the base wallet. Safe{Wallet} Privacy Policy · Ready Google Play data safety
31. Custodial exchange and payment apps — identity-linked telemetry. Because these services verify customer identity (KYC; see note 2), the usage data their apps collect is tied to a verified identity rather than being anonymous. Their App Store and Google Play disclosures list extensive collection spanning identifiers, financial and contact information, and usage, and several — Coinbase among them — also declare data used to track you across other companies’ apps. Labels vary by service and change over time; the linked example is representative. Coinbase App Store privacy label · FinCEN — Bank Secrecy Act (KYC)
32. CoinJoin availability (2024–2026). CoinJoin combines several users’ coins in one transaction to break chain-analysis links. The coordinator landscape narrowed sharply in 2024: zkSNACKs discontinued the Wasabi coordinator on 1 June 2024, so Wasabi now depends on independent third-party coordinators and blocks U.S. participants; Trezor Suite removed its CoinJoin feature entirely (it had relied on the zkSNACKs coordinator); and Sparrow removed its Whirlpool integration (v1.9.0) after the Samourai service was seized. Wasabi coordinator shutdown · Trezor Suite CoinJoin discontinuation
33. Silent Payments, PayJoin, and MWEB. Silent Payments (BIP-352) let a wallet publish one reusable address while a fresh on-chain address is derived for each payment, giving receivers strong privacy; PayJoin (BIP-78, and the newer v2 / BIP-77) is a collaborative send that breaks the common-input-ownership heuristic; MWEB is Litecoin’s confidential-transaction layer. Cake Wallet was the first mobile wallet to ship both Silent Payments and PayJoin v2 and an early cross-platform MWEB wallet; Sparrow supports receiving Silent Payments with a compatible server, and BitBox02 supports sending to them. Cake Wallet: Silent Payments & PayJoin v2 · Silent Payments wallet comparison
34. Ledger Live — coin control. Ledger’s companion software offers coin control for Bitcoin, letting you choose which UTXOs a transaction spends — to avoid dusting-based tracking and manage fees; the feature is Bitcoin-only. Ledger — Using Coin Control
35. Blockstream Jade (Green app) — coin control. Jade’s companion app, Blockstream Green, adds coin control over Bitcoin and Liquid UTXOs and guards against dust attacks, alongside built-in Tor and own-node connection. Blockstream — Green Coin Control
36. Trust Wallet — no coin control. Trust Wallet holds Bitcoin, but its software selects UTXOs automatically with no manual coin-control option, so spends can’t be curated to keep coin sources apart. Trust Wallet — What is a UTXO
37. Exodus — no coin control. Exodus manages Bitcoin and other UTXO assets but offers no manual coin/UTXO selection; it can rotate receive addresses for privacy, yet leaves input selection automatic. Exodus — What are UTXOs
38. Lightning — on-chain footprint and routing metadata. Lightning moves payments off-chain, but opening and closing a channel are ordinary Bitcoin transactions recorded on-chain, and channels are announced to the network, so their funding UTXOs are identifiable; payment routing is onion-encrypted, yet node metadata — and a node’s IP address, without Tor — can still leak. Lightning privacy notes (t-bast)